dsh-mishu 0.5.1 → 0.6.2

package/lib/core/github/device.js

@@ -0,0 +1,129 @@
+/**
+ * "Sign in with GitHub" without pasting a token: GitHub's device flow.
+ *
+ * The secretary asks GitHub for a short code, you enter it at
+ * github.com/login/device (on any computer) and approve, and the secretary
+ * receives a token, checks it like a pasted one and keeps it in the
+ * keychain (or the secrets file). It needs the client id of a GitHub OAuth
+ * App with device flow enabled; the id is public, there is no secret.
+ *
+ * https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow
+ */
+import { bi, MishuError } from "../i18n.js";
+import { saveGithubToken } from "./token.js";
+/** Notifications, and repo so CI runs, pull requests and issues of private repositories can be looked up. */
+export const DEVICE_SCOPES = 'notifications repo';
+export class GithubDeviceLogin {
+    options;
+    current = { state: 'idle' };
+    /** Bumped by every start and cancel, so an older poll loop stops quietly. */
+    generation = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    status() {
+        if (this.current.state === 'waiting' && this.now() > this.current.expiresAt) {
+            this.current = { state: 'failed', message: EXPIRED };
+        }
+        return this.current;
+    }
+    cancel() {
+        this.generation++;
+        this.current = { state: 'idle' };
+    }
+    /** Ask GitHub for a code; polling for your approval runs in the background. */
+    async start() {
+        if (this.options.clientId === '') {
+            throw new MishuError(bi('还没有配置 GitHub 应用，没法用 GitHub 登录。可以改用下面的"粘贴 token"。', 'No GitHub app is configured, so signing in with GitHub is not available. Paste a token below instead.'));
+        }
+        const generation = ++this.generation;
+        const answer = await this.form('https://github.com/login/device/code', { client_id: this.options.clientId, scope: DEVICE_SCOPES });
+        const deviceCode = String(answer.device_code ?? '');
+        const userCode = String(answer.user_code ?? '');
+        if (deviceCode === '' || userCode === '')
+            throw new MishuError(failure(answer));
+        const expiresAt = this.now() + Number(answer.expires_in ?? 900) * 1000;
+        this.current = { state: 'waiting', userCode, verificationUri: String(answer.verification_uri ?? 'https://github.com/login/device'), expiresAt };
+        void this.poll(generation, deviceCode, Number(answer.interval ?? 5), expiresAt);
+        return this.current;
+    }
+    async poll(generation, deviceCode, interval, expiresAt) {
+        const stale = () => generation !== this.generation;
+        try {
+            while (!stale()) {
+                await this.sleep(interval * 1000);
+                if (stale())
+                    return;
+                if (this.now() > expiresAt) {
+                    this.current = { state: 'failed', message: EXPIRED };
+                    return;
+                }
+                const answer = await this.form('https://github.com/login/oauth/access_token', {
+                    client_id: this.options.clientId,
+                    device_code: deviceCode,
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                });
+                if (stale())
+                    return;
+                if (typeof answer.access_token === 'string' && answer.access_token !== '') {
+                    const { login } = await saveGithubToken(this.options.secrets, answer.access_token, this.options.fetch);
+                    if (!stale())
+                        this.current = { state: 'done', login };
+                    return;
+                }
+                switch (answer.error) {
+                    case 'authorization_pending':
+                        break;
+                    case 'slow_down':
+                        interval = Number(answer.interval ?? interval + 5);
+                        break;
+                    case 'expired_token':
+                        this.current = { state: 'failed', message: EXPIRED };
+                        return;
+                    case 'access_denied':
+                        this.current = { state: 'failed', message: bi('你在 GitHub 上取消了授权。', 'You cancelled the authorization on GitHub.') };
+                        return;
+                    default:
+                        this.current = { state: 'failed', message: failure(answer) };
+                        return;
+                }
+            }
+        }
+        catch (error) {
+            if (!stale())
+                this.current = { state: 'failed', message: error instanceof MishuError ? error.text : bi(`连不上 GitHub：${error.message}`, `Could not reach GitHub: ${error.message}`) };
+        }
+    }
+    async form(url, fields) {
+        const post = this.options.post ?? globalThis.fetch;
+        const response = await post(url, {
+            method: 'POST',
+            headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded', 'user-agent': 'dsh-mishu' },
+            body: new URLSearchParams(fields).toString(),
+        });
+        const text = await response.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return { error: `http_${response.status}`, error_description: text.slice(0, 200) };
+        }
+    }
+    now() {
+        return (this.options.now ?? Date.now)();
+    }
+    sleep(ms) {
+        return (this.options.sleep ?? (wait => new Promise(resolve => setTimeout(resolve, wait))))(ms);
+    }
+}
+const EXPIRED = bi('登录码过期了，再点一次"用 GitHub 登录"。', 'The sign-in code expired; click "Sign in with GitHub" again.');
+function failure(answer) {
+    const what = String(answer.error_description ?? answer.error ?? 'unknown error');
+    if (answer.error === 'http_404' || /^not found$/i.test(String(answer.error ?? answer.message ?? ''))) {
+        return bi('GitHub 找不到这个应用：Client ID 不对。', 'GitHub does not know this app: the client id is wrong.');
+    }
+    if (answer.error === 'device_flow_disabled') {
+        return bi('这个 GitHub 应用没有打开"设备登录"（Enable Device Flow）。', 'This GitHub app does not have device flow enabled.');
+    }
+    return bi(`GitHub 登录没成功：${what}`, `Signing in with GitHub failed: ${what}`);
+}

package/lib/core/github/token.js

@@ -12,6 +12,8 @@ import { bi, MishuError } from "../i18n.js";
 import { GitHubClient, GitHubError } from "./client.js";
 /** The keychain entry for a token pasted on the settings page. */
 export const GITHUB_SECRET = 'github';
+/** The OAuth App behind "Sign in with GitHub" (device flow, "DSH 小秘书"); public, not a secret. */
+export const GITHUB_CLIENT_ID = 'Ov23liejlNOyARQKgy5x';
 /** Opens GitHub's "new classic token" page with the two scopes ticked. */
 export const NEW_TOKEN_URL = 'https://github.com/settings/tokens/new?scopes=notifications,repo&description=DSH%20mishu';
 /** `ghPath` is for tests: a fixed path, or `null` for "not installed". */

package/lib/core/index.js

@@ -11,19 +11,21 @@ export { GitHubClient, GitHubError } from "./github/client.js";
 export { gatherFacts, Lookups, parseCheckSuiteTitle } from "./github/facts.js";
 export { CLOSING_REASONS, judge } from "./github/rules.js";
 export { syncGithub } from "./github/sync.js";
-export { deleteGithubToken, GITHUB_SECRET, NEW_TOKEN_URL, resolveGithubToken, saveGithubToken } from "./github/token.js";
+export { DEVICE_SCOPES, GithubDeviceLogin } from "./github/device.js";
+export { deleteGithubToken, GITHUB_CLIENT_ID, GITHUB_SECRET, NEW_TOKEN_URL, resolveGithubToken, saveGithubToken } from "./github/token.js";
 export { bi, decode, detectLang, errorText, LANGS, MishuError, pick } from "./i18n.js";
 export { addSeries, describeActiveSeries, describeSeries, resolveSeries, stopSeries, tickManual, upcoming, } from "./manual.js";
 export { DEFAULT_DEMOTION, isActive, isDemoted, setStatusByUser, snoozeByUser } from "./matters.js";
 export { CATEGORIES, CATEGORY_LABELS, DEFAULT_LEAD_DAYS, REPEATS } from "./recur.js";
 export { MishuStore } from "./store.js";
 export { addDays, dayOf, formatMoment } from "./time.js";
-export { MAIL_PRESETS, presetById, secretAccount } from "./mail/account.js";
+export { MAIL_PRESETS, normalizePassword, presetById, presetForAddress, providerMismatch, secretAccount } from "./mail/account.js";
 export { ImapFetcher } from "./mail/imap.js";
 export { judgeMail } from "./mail/rules.js";
 export { describeMailError, MAIL_SOURCE, mailReportKey, syncMail } from "./mail/sync.js";
 export { findProgram } from "./exec.js";
-export { MemorySecrets, secretEnvName, secretFromEnv, systemSecrets } from "./secrets.js";
+export { restartPlan, scheduleRestart } from "./restart.js";
+export { FileSecrets, KeychainOrFile, MemorySecrets, secretEnvName, secretFromEnv, systemSecrets } from "./secrets.js";
 export { deleteMailAccount, effectiveSettings, mailAccounts, saveMailAccount, saveSettings } from "./settings.js";
 export const DEFAULT_HOME = '~/.mishu';
 /** `~` and `~/…` expand to the home directory on every platform. */
@@ -36,5 +38,5 @@ export function expandHome(path) {
 }
 export function mishuPaths(home) {
     const root = expandHome(home);
-    return { root, db: join(root, 'mishu.db') };
+    return { root, db: join(root, 'mishu.db'), secrets: join(root, 'secrets.json') };
 }

package/lib/core/mail/account.js

@@ -6,37 +6,93 @@
  * system keychain under `mail:<id>`, never in the notebook.
  */
 import { bi, MishuError } from "../i18n.js";
+/** Steps, and the same steps as one numbered paragraph. */
+function guide(steps) {
+    return {
+        steps,
+        howTo: bi(steps.map((step, i) => `${i + 1}. ${step.text.zh}`).join(' '), steps.map((step, i) => `${i + 1}. ${step.text.en}`).join(' ')),
+    };
+}
+const NETEASE = (name, url) => guide([
+    { text: bi(`打开 ${name} 邮箱网页版并登录。`, `Open ${name} Mail on the web and sign in.`), link: { url, label: bi(`打开 ${name} 邮箱`, `Open ${name} Mail`) } },
+    { text: bi('点上方的「设置」→「POP3/SMTP/IMAP」，开启「IMAP/SMTP 服务」。', 'Click Settings → POP3/SMTP/IMAP at the top and turn on "IMAP/SMTP".') },
+    { text: bi('按提示用手机验证，页面会给你一个「客户端授权码」，复制后粘贴到下面的密码框（不是邮箱登录密码）。', 'Verify with your phone as asked; the page shows a client authorization code. Copy it into the password box below (not your mail password).') },
+]);
 export const MAIL_PRESETS = [
     {
         id: 'qq', label: bi('QQ 邮箱', 'QQ Mail'), host: 'imap.qq.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 QQ 邮箱网页版：设置 → 账号与安全 → 安全设置（旧版界面是 设置 → 账户），开启「IMAP/SMTP 服务」，按提示验证后生成 16 位授权码。这里填授权码，不是 QQ 密码；改过 QQ 密码后，旧授权码会失效。', 'In QQ Mail on the web: Settings → Account and Security → Security (Settings → Account in the older layout), turn on "IMAP/SMTP", verify, and generate a 16-character authorization code. Enter that code here, not your QQ password; changing your QQ password expires old codes.'),
+        domains: ['qq.com', 'vip.qq.com', 'foxmail.com'], passwordLength: 16,
+        ...guide([
+            { text: bi('打开 QQ 邮箱网页版并登录。', 'Open QQ Mail on the web and sign in.'), link: { url: 'https://mail.qq.com/', label: bi('打开 QQ 邮箱', 'Open QQ Mail') } },
+            { text: bi('点「设置」→「账号与安全」→「安全设置」（旧版界面是「设置」→「账户」），找到「IMAP/SMTP 服务」，点「开启」。', 'Click Settings → Account and Security → Security (Settings → Account in the older layout), find "IMAP/SMTP" and turn it on.') },
+            { text: bi('按提示用手机验证，页面会显示一个 16 位授权码，复制后粘贴到下面的密码框（不是 QQ 密码）。改过 QQ 密码后，旧授权码会失效。', 'Verify with your phone as asked; the page shows a 16-character authorization code. Copy it into the password box below (not your QQ password). Changing your QQ password expires old codes.') },
+        ]),
     },
     {
         id: '163', label: bi('网易 163 邮箱', 'NetEase 163'), host: 'imap.163.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 163 邮箱网页版：设置 → POP3/SMTP/IMAP → 开启 IMAP 服务，设置客户端授权码。这里填授权码。', 'In 163 Mail on the web: Settings → POP3/SMTP/IMAP → turn on IMAP and set a client authorization code. Enter that code here.'),
+        domains: ['163.com'], ...NETEASE('163', 'https://mail.163.com/'),
     },
     {
         id: '126', label: bi('网易 126 邮箱', 'NetEase 126'), host: 'imap.126.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 126 邮箱网页版：设置 → POP3/SMTP/IMAP → 开启 IMAP 服务，设置客户端授权码。这里填授权码。', 'In 126 Mail on the web: Settings → POP3/SMTP/IMAP → turn on IMAP and set a client authorization code. Enter that code here.'),
+        domains: ['126.com'], ...NETEASE('126', 'https://mail.126.com/'),
     },
     {
         id: 'gmail', label: bi('Gmail', 'Gmail'), host: 'imap.gmail.com', port: 993, secure: true, supported: true,
-        howTo: bi('Google 账号先开启两步验证，再到「安全性 → 应用专用密码」生成一个 16 位密码，填在这里。', 'Turn on 2-Step Verification for your Google account, then create an app password under Security → App passwords and enter it here.'),
+        domains: ['gmail.com', 'googlemail.com'], passwordLength: 16,
+        ...guide([
+            {
+                text: bi('开启 Google 账号的两步验证（已经开了就跳过这步）。', 'Turn on 2-Step Verification for your Google account (skip this if it is on).'),
+                link: { url: 'https://myaccount.google.com/signinoptions/twosv', label: bi('打开两步验证', 'Open 2-Step Verification') },
+            },
+            {
+                text: bi('打开「应用专用密码」页面，名字随便填（比如"小秘书"），点「创建」。如果页面说"设置不可用"，说明第 1 步还没做。', 'Open the App passwords page, type any name ("secretary") and click Create. If the page says the setting is not available, step 1 is not done yet.'),
+                link: { url: 'https://myaccount.google.com/apppasswords', label: bi('打开应用专用密码', 'Open App passwords') },
+            },
+            { text: bi('把弹出来的 16 位密码复制，粘贴到下面的密码框（带不带空格都行）。它只显示这一次。', 'Copy the 16-character password it shows into the password box below (spaces or not). It is shown only once.') },
+        ]),
         findMessage: id => `https://mail.google.com/mail/u/0/#search/rfc822msgid:${encodeURIComponent(id)}`,
     },
     {
         id: 'icloud', label: bi('iCloud 邮件', 'iCloud Mail'), host: 'imap.mail.me.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 appleid.apple.com：登录与安全 → App 专用密码，生成一个填在这里。用户名一般是 @icloud.com 前面的部分。', 'At appleid.apple.com: Sign-In and Security → App-Specific Passwords; create one and enter it here. The user name is usually the part before @icloud.com.'),
+        domains: ['icloud.com', 'me.com', 'mac.com'],
+        ...guide([
+            { text: bi('打开 Apple 账户页面并登录。', 'Open your Apple Account page and sign in.'), link: { url: 'https://account.apple.com/account/manage', label: bi('打开 Apple 账户', 'Open Apple Account') } },
+            { text: bi('点「登录与安全」→「App 专用密码」，点「+」，名字随便填。', 'Click Sign-In and Security → App-Specific Passwords, click +, and type any name.') },
+            { text: bi('把显示的密码（xxxx-xxxx-xxxx-xxxx）复制，粘贴到下面的密码框。', 'Copy the password it shows (xxxx-xxxx-xxxx-xxxx) into the password box below.') },
+        ]),
     },
     {
         id: 'outlook', label: bi('Outlook / Hotmail', 'Outlook / Hotmail'), host: 'outlook.office365.com', port: 993, secure: true, supported: false,
+        domains: ['outlook.com', 'hotmail.com', 'live.com', 'msn.com'], steps: [],
         howTo: bi('微软已经不允许用密码登录 IMAP，需要 OAuth 授权，小秘书暂时还不支持。', 'Microsoft no longer allows password logins over IMAP; it needs OAuth, which the secretary does not support yet.'),
     },
     {
         id: 'custom', label: bi('其他（自己填服务器）', 'Other (enter the server)'), host: '', port: 993, secure: true, supported: true,
+        domains: [], steps: [],
         howTo: bi('填你的邮件服务商给的 IMAP 服务器、端口和密码（很多服务商要求用专门的客户端授权码）。', 'Enter the IMAP server, port and password your provider gives you (many require a separate app password).'),
     },
 ];
+/** The provider an address belongs to, from its domain; `undefined` when we do not know it. */
+export function presetForAddress(address) {
+    const domain = address.trim().toLowerCase().split('@')[1] ?? '';
+    return MAIL_PRESETS.find(p => p.domains.includes(domain));
+}
+/**
+ * The password as the server wants it. App passwords and codes are shown in
+ * groups ("abcd efgh ijkl mnop") and copied with the spaces; they never
+ * contain one, so spaces go when the provider fixes the length.
+ */
+export function normalizePassword(presetId, password) {
+    return presetById(presetId).passwordLength === undefined ? password : password.replace(/\s+/g, '');
+}
+/** An account whose address belongs to another provider than its server ("…@gmail.com" on imap.qq.com). */
+export function providerMismatch(account) {
+    const expected = presetForAddress(account.address);
+    if (expected === undefined || expected.id === account.preset || account.preset === 'custom')
+        return undefined;
+    const domain = account.address.split('@')[1];
+    return bi(`地址是 ${domain}，服务器却是 ${presetById(account.preset).label.zh}的 ${account.host}。点「编辑」把服务商改成「${expected.label.zh}」。`, `The address is ${domain} but the server is ${account.host} (${presetById(account.preset).label.en}). Click Edit and choose "${expected.label.en}".`);
+}
 export function presetById(id) {
     return MAIL_PRESETS.find(p => p.id === id) ?? MAIL_PRESETS[MAIL_PRESETS.length - 1];
 }

package/lib/core/mail/sync.js

@@ -11,15 +11,44 @@ import { bi } from "../i18n.js";
 import { presetById } from "./account.js";
 import { judgeMail } from "./rules.js";
 export const MAIL_SOURCE = 'mail';
-/** A connection or login failure, said so a person knows what to fix. */
-export function describeMailError(error, account) {
+/** What some providers' refusals mean, in words you can act on. */
+const KNOWN_REFUSALS = [
+    {
+        presets: ['gmail'], match: /application-specific password required/i,
+        text: bi('Google 不接受账号的登录密码：这里要填「应用专用密码」（16 位）。按步骤第 1、2 步生成一个，大约一分钟。', 'Google does not take your account password here: it needs an app password (16 characters). Steps 1 and 2 make one in about a minute.'),
+    },
+    {
+        presets: ['gmail'], match: /invalid credentials/i,
+        text: bi('Google 不认这个应用专用密码：可能抄错了，或者已经在 Google 账号里删掉了。按步骤第 2 步重新生成一个再试。', 'Google does not accept this app password: it may be mistyped or deleted from your Google account. Make a new one with step 2 and try again.'),
+    },
+    {
+        presets: ['gmail'], match: /web login required|log in via your web browser/i,
+        text: bi('Google 拦下了这次登录：先在浏览器里登录一次 Gmail，再回来试。', 'Google blocked this sign-in: sign in to Gmail in a browser once, then try again.'),
+    },
+    {
+        presets: ['qq'], match: /login fail/i,
+        text: bi('QQ 邮箱不让登录：最常见是还没开启 IMAP 服务，或者填的是 QQ 密码而不是授权码；改过 QQ 密码后，旧授权码也会失效。', 'QQ Mail refused the sign-in: usually IMAP is not turned on, or this is your QQ password instead of the authorization code; changing your QQ password also expires old codes.'),
+    },
+    {
+        presets: ['163', '126'], match: /unsafe login/i,
+        text: bi('网易邮箱拦下了这次登录：确认设置里已开启 IMAP 服务，并且填的是客户端授权码。', 'NetEase Mail blocked this sign-in: check that IMAP is turned on in its settings and that this is the client authorization code.'),
+    },
+];
+/**
+ * A connection or login failure, said so a person knows what to fix. With
+ * `steps` (the default) a login failure also repeats where the provider's
+ * app password comes from; the add-account dialog shows those steps already.
+ */
+export function describeMailError(error, account, options = {}) {
     const raw = error.responseText ?? error.message ?? String(error);
-    const auth = /auth|login|password|credential|AUTHENTICATIONFAILED|LOGIN failed/i.test(raw);
+    const known = KNOWN_REFUSALS.find(k => k.presets.includes(account.preset) && k.match.test(raw));
+    const auth = known !== undefined || /auth|login|password|credential|AUTHENTICATIONFAILED|LOGIN failed/i.test(raw);
     if (!auth)
         return bi(`连接 ${account.host}:${account.port} 失败：${raw}`, `Could not reach ${account.host}:${account.port}: ${raw}`);
     const preset = presetById(account.preset);
-    const howTo = preset.id === 'custom' ? undefined : preset.howTo;
-    return bi(`登录失败：服务器不接受这个用户名或密码（${raw}）。多数邮箱要先开启 IMAP，再填客户端授权码或应用专用密码，不是网页登录密码。${howTo === undefined ? '' : `\n${preset.label.zh}：${howTo.zh}`}`, `Login failed: the server rejected the user name or password (${raw}). Most providers need IMAP turned on and an app password, not your web password.${howTo === undefined ? '' : `\n${preset.label.en}: ${howTo.en}`}`);
+    const steps = options.steps !== false && preset.id !== 'custom' ? preset.howTo : undefined;
+    const what = known?.text ?? bi('登录失败：服务器不接受这个用户名或密码。多数邮箱要先开启 IMAP，再填客户端授权码或应用专用密码，不是网页登录密码。', 'Login failed: the server rejected the user name or password. Most providers need IMAP turned on and an app password, not your web password.');
+    return bi(`${what.zh}（服务器原话：${raw}）${steps === undefined ? '' : `\n${preset.label.zh}：${steps.zh}`}`, `${what.en} (The server said: ${raw})${steps === undefined ? '' : `\n${preset.label.en}: ${steps.en}`}`);
 }
 export function mailReportKey(accountId) {
     return `mail.lastSync.${accountId}`;

package/lib/core/restart.js

@@ -0,0 +1,179 @@
+/**
+ * Restarting DSH after plugins were reinstalled or upgraded.
+ *
+ * In the desktop app, DSH runs as a child of the app's main process
+ * (Electron as Node, `ELECTRON_RUN_AS_NODE=1`). The `dsh` command runs on
+ * the same binary the same way, so the test is the parent: only when the
+ * parent process IS this app binary is there an app to restart (from a
+ * terminal the parent is a shell, and `__CFBundleIdentifier` names the
+ * terminal app — never trusted). A restart asks the app to
+ * quit the normal way — so it still asks first when a task is running — and
+ * opens it again once it is gone. That is done by a small detached helper,
+ * because this process ends with the app.
+ *
+ *   macOS    AppleScript `quit`, then `open -b <bundle id>`   (tested)
+ *   Windows  `taskkill /PID` without /F (a close request), then the app again
+ *   Linux    SIGTERM to the app, then the app again
+ *
+ * On a server set up with dsh-vps, DSH is a child of the dsh-gate login
+ * gateway (`$GATE_HOME/gate/server.js`, run by systemd), which starts DSH
+ * again whenever it exits and picks up the new sign-in token itself. There
+ * a restart is simply DSH exiting cleanly; the page reconnects.
+ *
+ * DSH started with the `dsh` command is not restarted from here: its web
+ * address (with a new sign-in token) is printed in that terminal, which a
+ * detached replacement could not reach. The page says what to do instead.
+ */
+import { execFileSync, spawn } from 'node:child_process';
+import { readFileSync, readlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, posix } from 'node:path';
+import { findProgram } from "./exec.js";
+import { bi } from "./i18n.js";
+/** `<x>.app` holding a macOS executable, if any. */
+function appBundle(execPath) {
+    const at = execPath.indexOf('.app/');
+    return at < 0 ? undefined : execPath.slice(0, at + 4);
+}
+function parentExecutable(ppid, platform) {
+    try {
+        if (platform === 'linux')
+            return readlinkSync(`/proc/${ppid}/exe`);
+        if (platform === 'win32') {
+            const ps = findProgram('powershell');
+            return ps === undefined ? undefined : execFileSync(ps, ['-NoProfile', '-NonInteractive', '-Command', `(Get-Process -Id ${ppid}).Path`], { timeout: 10_000, windowsHide: true }).toString().trim();
+        }
+        return execFileSync('/bin/ps', ['-o', 'comm=', '-p', String(ppid)], { timeout: 5000 }).toString().trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function bundleIdOf(app) {
+    try {
+        return execFileSync('/usr/bin/defaults', ['read', `${app}/Contents/Info`, 'CFBundleIdentifier'], { timeout: 5000 }).toString().trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function parentArguments(ppid) {
+    try {
+        return readFileSync(`/proc/${ppid}/cmdline`, 'utf8').split('\0').filter(Boolean);
+    }
+    catch {
+        return undefined;
+    }
+}
+function here() {
+    const facts = {
+        env: process.env, platform: process.platform, execPath: process.execPath, ppid: process.ppid, electron: process.versions.electron,
+        parentExe: undefined, bundleId: undefined, parentArgs: undefined,
+    };
+    if (facts.platform === 'linux' && facts.env.GATE_HOME !== undefined)
+        facts.parentArgs = parentArguments(facts.ppid);
+    if (facts.electron === undefined || facts.env.ELECTRON_RUN_AS_NODE !== '1' || facts.ppid <= 1)
+        return facts;
+    facts.parentExe = parentExecutable(facts.ppid, facts.platform);
+    const app = facts.platform === 'darwin' ? appBundle(facts.execPath) : undefined;
+    if (app !== undefined)
+        facts.bundleId = bundleIdOf(app);
+    return facts;
+}
+function samePath(a, b, platform) {
+    return a !== undefined && (platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b);
+}
+const FROM_TERMINAL = bi('这个 DSH 是用 dsh 命令启动的，小秘书没法替它重启：回到运行 dsh 的那个终端按 Ctrl+C，再运行同一条命令。', 'This DSH was started with the dsh command, so the secretary cannot restart it: press Ctrl+C in the terminal running dsh, then run the same command again.');
+/** How DSH can be restarted from here, or why it cannot. */
+export function restartPlan(facts = here()) {
+    // dsh-vps: the parent must be that very gateway, not just a shell that has GATE_HOME set.
+    const gateHome = facts.env.GATE_HOME;
+    if (gateHome !== undefined && gateHome !== '') {
+        const gate = posix.join(gateHome, 'gate', 'server.js');
+        if (facts.parentArgs?.includes(gate) === true)
+            return { kind: 'gate', gate };
+    }
+    const desktop = facts.electron !== undefined && facts.env.ELECTRON_RUN_AS_NODE === '1' && facts.ppid > 1 && samePath(facts.parentExe, facts.execPath, facts.platform);
+    if (!desktop)
+        return { kind: 'none', why: FROM_TERMINAL };
+    if (facts.platform === 'darwin') {
+        const bundleId = facts.bundleId ?? '';
+        if (/^[\w.-]+$/.test(bundleId))
+            return { kind: 'macos-app', bundleId, appPid: facts.ppid };
+        return { kind: 'none', why: bi('没找到桌面版的应用标识，没法替它重启。请退出 DSH 再打开。', 'Could not tell which app this is, so it cannot be restarted from here. Quit DSH and open it again.') };
+    }
+    if (facts.platform === 'win32' || facts.platform === 'linux')
+        return { kind: 'desktop-app', platform: facts.platform, exe: facts.execPath, appPid: facts.ppid };
+    return { kind: 'none', why: bi('这个系统上没法替桌面版重启。请退出 DSH 再打开。', 'The desktop app cannot be restarted from here on this system. Quit DSH and open it again.') };
+}
+const MAC_TOOLS = { osascript: '/usr/bin/osascript', open: '/usr/bin/open' };
+/**
+ * Source of the detached helper: ask the app to quit, wait until it is gone
+ * (giving up quietly when you cancel the quit), open it again, and check it
+ * came back. Every step is noted in `log`, the only account of a restart
+ * once this process is gone.
+ *
+ * The helper itself runs as Node (`ELECTRON_RUN_AS_NODE=1`), and whatever it
+ * launches inherits its environment — `open` included ("Opened applications
+ * inherit environment variables", open(1)). So the app is always started
+ * without that variable; with it, the app starts as bare Node and exits.
+ */
+export function restartHelperSource(plan, log, tools = MAC_TOOLS) {
+    const mac = plan.kind === 'macos-app';
+    const app = mac ? `application id ${JSON.stringify(plan.bundleId)}` : '';
+    const quit = mac
+        ? `spawnSync(${JSON.stringify(tools.osascript)}, ['-e', ${JSON.stringify(`tell ${app} to quit`)}], { timeout: 180000 })`
+        : plan.platform === 'win32'
+            ? `spawnSync('taskkill', ['/PID', String(pid)], { windowsHide: true })`
+            : `process.kill(pid, 'SIGTERM')`;
+    // Answers whether the app runs again; only macOS can ask, elsewhere the launch is trusted.
+    const running = mac
+        ? `String(spawnSync(${JSON.stringify(tools.osascript)}, ['-e', ${JSON.stringify(`${app} is running`)}], { timeout: 10000 }).stdout).trim() === 'true'`
+        : 'true';
+    const open = mac
+        ? `const r = spawnSync(${JSON.stringify(tools.open)}, ['-b', ${JSON.stringify(plan.bundleId)}], { env: clean, timeout: 60000 }); note('open exited ' + r.status + (String(r.stderr || '').trim() ? ': ' + String(r.stderr).trim() : ''))`
+        : `spawn(${JSON.stringify(plan.exe)}, [], { detached: true, stdio: 'ignore', env: clean }).unref()`;
+    return [
+        "const { spawn, spawnSync } = require('node:child_process')",
+        "const fs = require('node:fs')",
+        `const pid = ${plan.appPid}`,
+        `const log = ${JSON.stringify(log)}`,
+        "const clean = Object.fromEntries(Object.entries(process.env).filter(([k]) => k !== 'ELECTRON_RUN_AS_NODE'))",
+        "const note = (line) => { try { fs.appendFileSync(log, new Date().toISOString() + ' ' + line + '\\n') } catch {} }",
+        'const sleep = (ms) => new Promise(r => setTimeout(r, ms))',
+        "const alive = () => { try { process.kill(pid, 0); return true } catch (e) { return e.code === 'EPERM' } }",
+        `const running = () => { try { return ${running} } catch { return false } }`,
+        `const open = () => { try { ${open} } catch (e) { note('could not open the app: ' + (e && e.message)) } }`,
+        'const main = async () => {',
+        // Let the page receive its answer before the app starts closing.
+        '  await sleep(400)',
+        "  note('asking the app (pid ' + pid + ') to quit')",
+        `  try { ${quit} } catch (e) { note('quit request failed: ' + (e && e.message)) }`,
+        '  const until = Date.now() + 180000',
+        '  while (alive() && Date.now() < until) await sleep(300)',
+        "  if (alive()) { note('the app is still running (the quit was cancelled?); not reopening'); return }",
+        '  await sleep(800)',
+        '  for (let attempt = 1; attempt <= 2; attempt++) {',
+        "    note('opening the app (attempt ' + attempt + ')')",
+        '    open()',
+        '    const by = Date.now() + 20000',
+        '    while (!running() && Date.now() < by) await sleep(500)',
+        "    if (running()) { note('the app is running again'); return }",
+        '  }',
+        "  note('the app did not come back; open it yourself')",
+        '}',
+        "main().catch(e => note('helper failed: ' + (e && e.stack || e)))",
+    ].join('\n');
+}
+/** Start the restart: under dsh-gate, exit; in the desktop app, start the helper and say where it logs. Runs with this process's Node (Electron as Node in the app). */
+export function scheduleRestart(plan, exit = () => process.kill(process.pid, 'SIGTERM')) {
+    if (plan.kind === 'gate') {
+        // Let the page receive its answer, then leave the normal way; the gateway starts DSH again.
+        setTimeout(exit, 400);
+        return { reconnect: true };
+    }
+    const log = join(tmpdir(), `dsh-mishu-restart-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}.log`);
+    const helper = spawn(process.execPath, ['-e', restartHelperSource(plan, log)], { detached: true, stdio: 'ignore', env: process.env, windowsHide: true });
+    helper.unref();
+    return { log };
+}

package/lib/core/secrets.js

@@ -7,9 +7,17 @@
  *
  * Secrets travel to the helper on stdin only, never as command-line
  * arguments, which other processes on the machine could read. Everything is
- * stored under the service name "dsh-mishu". When no keychain is available,
- * `secretFromEnv` is the documented fallback.
+ * stored under the service name "dsh-mishu".
+ *
+ * A computer without a usable keychain (a Linux server with no desktop,
+ * say) keeps them in `secrets.json` in the notebook directory instead:
+ * mode 600, so only your own system account can read it. That is how gh,
+ * git and Thunderbird manage on such machines, and it is said plainly on
+ * the settings page: protected by file permissions, not encrypted.
+ * `secretFromEnv` remains a last resort.
  */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
 import { findProgram, runProgram } from "./exec.js";
 import { bi } from "./i18n.js";
 export const SERVICE = 'dsh-mishu';
@@ -168,3 +176,95 @@ export function secretFromEnv(account) {
     const value = process.env[secretEnvName(account)];
     return value === undefined || value === '' ? undefined : value;
 }
+/**
+ * Secrets in one JSON file, readable by your system account only (600).
+ * Written to a temporary file first and renamed, so a crash never leaves
+ * half a file; a file that cannot be read is never overwritten.
+ */
+export class FileSecrets {
+    kind = 'file';
+    path;
+    constructor(path) { this.path = path; }
+    async status() { return { available: true }; }
+    read() {
+        if (!existsSync(this.path))
+            return {};
+        // Put the permissions back if something loosened them.
+        if (process.platform !== 'win32' && (statSync(this.path).mode & 0o077) !== 0)
+            chmodSync(this.path, 0o600);
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.path, 'utf8'));
+        }
+        catch (error) {
+            throw new Error(`${this.path} cannot be read (${error.message}); fix or remove it`);
+        }
+        const secrets = parsed.secrets;
+        return typeof secrets === 'object' && secrets !== null ? { ...secrets } : {};
+    }
+    write(secrets) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temp = `${this.path}.${process.pid}.tmp`;
+        writeFileSync(temp, `${JSON.stringify({ version: 1, secrets }, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temp, this.path);
+    }
+    async get(account) { return this.read()[account]; }
+    async set(account, secret) {
+        checkAccount(account);
+        checkSecret(secret);
+        this.write({ ...this.read(), [account]: secret });
+    }
+    async delete(account) {
+        const secrets = this.read();
+        if (!(account in secrets))
+            return;
+        delete secrets[account];
+        this.write(secrets);
+    }
+}
+/**
+ * The keychain when it works, else the file. Reads look in both, so a
+ * secret saved to the file before a keychain was set up is still found;
+ * saving to the keychain removes the file's copy.
+ */
+export class KeychainOrFile {
+    keychain;
+    file;
+    usable;
+    constructor(keychain, file) {
+        this.keychain = keychain;
+        this.file = file;
+    }
+    get kind() { return this.keychain.kind; }
+    keychainStatus() {
+        // Asked once per run: a missing helper does not appear while DSH runs.
+        this.usable ??= this.keychain.status().catch((error) => ({ available: false, why: bi(error.message, error.message) }));
+        return this.usable;
+    }
+    async status() {
+        const keychain = await this.keychainStatus();
+        return keychain.available ? keychain : { available: true, file: { path: this.file.path, why: keychain.why } };
+    }
+    async get(account) {
+        if ((await this.keychainStatus()).available) {
+            const stored = await this.keychain.get(account);
+            if (stored !== undefined)
+                return stored;
+        }
+        return this.file.get(account);
+    }
+    async set(account, secret) {
+        if ((await this.keychainStatus()).available) {
+            await this.keychain.set(account, secret);
+            await this.file.delete(account);
+        }
+        else {
+            await this.file.set(account, secret);
+        }
+    }
+    async delete(account) {
+        if ((await this.keychainStatus()).available)
+            await this.keychain.delete(account);
+        await this.file.delete(account);
+    }
+}

package/lib/core/settings.js

@@ -6,7 +6,7 @@
  * password goes to the system keychain (see secrets.ts), never here.
  */
 import { MishuError, bi } from "./i18n.js";
-import { resolveAccount, secretAccount } from "./mail/account.js";
+import { normalizePassword, resolveAccount, secretAccount } from "./mail/account.js";
 import { MAIL_SOURCE } from "./mail/sync.js";
 import { CATEGORIES } from "./recur.js";
 import { secretFromEnv } from "./secrets.js";
@@ -70,7 +70,7 @@ export async function saveMailAccount(store, secrets, input, password, now) {
     const account = resolveAccount({ ...existing, ...input }, id);
     const keychain = (await secrets.status()).available;
     if (keychain && password !== undefined && password !== '')
-        await secrets.set(secretAccount(id), password);
+        await secrets.set(secretAccount(id), normalizePassword(account.preset, password));
     else if (keychain && existing === undefined && await secrets.get(secretAccount(id)) === undefined && secretFromEnv(secretAccount(id)) === undefined) {
         throw new MishuError(bi('新邮箱要填密码（授权码）', 'a new account needs its password (app password)'));
     }